3 ms·
To whomever downvoted me, I've seen people suggest on this thread or ones in the last 24 hours that: - symmetric encryption is appropriate for sites' storing p
by drivebyacct2 14y ago
To whomever downvoted me, I've seen people suggest on this thread or ones in the last 24 hours that:
- symmetric encryption is appropriate for sites' storing passwords
- md5 is okay
- site-wide salts are just as secure as user specific salts
and more. Some of these were suggested by people that have far, far more karma than me. Some were suggested by people that had had this explained to them in previous threads and then took it upon themselves to mis-convey this information back. I don't have a pony in this race as I use different strong passwords per-site and I don't have user data to worry about. I just cringe everytime I see potential hackers reading this misinformation or hackers potentially with data who don't understand their risk or blindspots. I only mean the best, even if I come off exasperated.
- smoyer 14y agoDon't forget the guy that salted his own passwords - googlepassword, linkedinpassword, yahoopassword (yeah ... he probably has a Yahoo account).
- tetha 14y agoHow is this bad? I mean sure, if you can get access to one password, you will be able to predict passwords for other websites, however, these SALT + WEBSITE-passwords tend to end up very, very long, which makes it very hard to break. Afterall, every single password you listed there is at least 13 characters long.
- rrreese 14y agoI sense a lot of misinformation in the comments, do you know of a site or book that covers the best practices that we should be using?